Skip to content

Commit 4b1fa21

Browse files
gpapakyriakopoulosgpapakyriakopoulos
committed
Preserve AWS env for post upload
1 parent 52950e4 commit 4b1fa21

4 files changed

Lines changed: 178 additions & 2 deletions

File tree

‎dist/main/index.js‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34976,6 +34976,22 @@ const EVENTS_FILE = '/tmp/ebpf-network-events.json';
3497634976
const ORAS_VERSION = '1.2.3';
3497734977
const ORAS_FILENAME = `oras_${ORAS_VERSION}_linux_amd64.tar.gz`;
3497834978
const ORAS_LINUX_AMD64_SHA256 = 'b4efc97a91f471f323f193ea4b4d63d8ff443ca3aab514151a30751330852827';
34979+
const AWS_ENV_STATE_PREFIX = 'AWS_ENV_';
34980+
const AWS_ENV_NAMES = [
34981+
'AWS_ACCESS_KEY_ID',
34982+
'AWS_SECRET_ACCESS_KEY',
34983+
'AWS_SESSION_TOKEN',
34984+
'AWS_REGION',
34985+
'AWS_DEFAULT_REGION',
34986+
'AWS_PROFILE',
34987+
'AWS_SHARED_CREDENTIALS_FILE',
34988+
'AWS_CONFIG_FILE',
34989+
];
34990+
const AWS_SECRET_ENV_NAMES = new Set([
34991+
'AWS_ACCESS_KEY_ID',
34992+
'AWS_SECRET_ACCESS_KEY',
34993+
'AWS_SESSION_TOKEN',
34994+
]);
3497934995
// Resolve the binary tag from the action ref so that
3498034996
// `uses: skroutz/ebpf-tracker@v1.2.3` always pulls the v1.2.3 binary.
3498134997
// Falls back to 'latest' when run outside of Actions (e.g. local testing).
@@ -34996,6 +35012,23 @@ function verifyOrasTarball(tarball) {
3499635012
core.info(`Verified ORAS ${ORAS_VERSION} checksum (${actual})`);
3499735013
}
3499835014

35015+
function saveAwsEnvState() {
35016+
let saved = 0;
35017+
for (const name of AWS_ENV_NAMES) {
35018+
const value = process.env[name];
35019+
if (!value) continue;
35020+
if (AWS_SECRET_ENV_NAMES.has(name)) {
35021+
core.setSecret(value);
35022+
}
35023+
core.saveState(`${AWS_ENV_STATE_PREFIX}${name}`, value);
35024+
saved += 1;
35025+
}
35026+
35027+
if (saved > 0) {
35028+
core.info('Captured AWS environment for post S3 upload');
35029+
}
35030+
}
35031+
3499935032
/**
3500035033
* Poll until the tracker has written its PID file, or the timeout expires.
3500135034
* Returns the PID as a number, or null if the file never appeared.
@@ -35026,6 +35059,9 @@ async function run() {
3502635059

3502735060
core.saveState('OUTPUT_MODE', outputMode);
3502835061
core.saveState('S3_BUCKET', s3Bucket);
35062+
if (outputMode === 's3' && s3Bucket) {
35063+
saveAwsEnvState();
35064+
}
3502935065

3503035066
// Install ORAS CLI if not already on PATH.
3503135067
let orasPath = 'oras';

‎dist/post/index.js‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31572,6 +31572,22 @@ const dns = __nccwpck_require__(2250);
3157231572
const EVENTS_FILE = '/tmp/ebpf-network-events.json';
3157331573
const SHUTDOWN_TIMEOUT_MS = 15000;
3157431574
const POLL_INTERVAL_MS = 100;
31575+
const AWS_ENV_STATE_PREFIX = 'AWS_ENV_';
31576+
const AWS_ENV_NAMES = [
31577+
'AWS_ACCESS_KEY_ID',
31578+
'AWS_SECRET_ACCESS_KEY',
31579+
'AWS_SESSION_TOKEN',
31580+
'AWS_REGION',
31581+
'AWS_DEFAULT_REGION',
31582+
'AWS_PROFILE',
31583+
'AWS_SHARED_CREDENTIALS_FILE',
31584+
'AWS_CONFIG_FILE',
31585+
];
31586+
const AWS_SECRET_ENV_NAMES = new Set([
31587+
'AWS_ACCESS_KEY_ID',
31588+
'AWS_SECRET_ACCESS_KEY',
31589+
'AWS_SESSION_TOKEN',
31590+
]);
3157531591

3157631592
function isAlive() {
3157731593
// Check by process name: this is the only reliable signal because the saved
@@ -31586,6 +31602,42 @@ function isAlive() {
3158631602
}
3158731603
}
3158831604

31605+
function getSavedAwsEnv() {
31606+
const savedEnv = {};
31607+
for (const name of AWS_ENV_NAMES) {
31608+
const value = core.getState(`${AWS_ENV_STATE_PREFIX}${name}`);
31609+
if (!value) continue;
31610+
if (AWS_SECRET_ENV_NAMES.has(name)) {
31611+
core.setSecret(value);
31612+
}
31613+
savedEnv[name] = value;
31614+
}
31615+
return savedEnv;
31616+
}
31617+
31618+
function hasSavedAwsCredentialSource(savedAwsEnv) {
31619+
return (
31620+
(savedAwsEnv.AWS_ACCESS_KEY_ID && savedAwsEnv.AWS_SECRET_ACCESS_KEY) ||
31621+
savedAwsEnv.AWS_PROFILE
31622+
);
31623+
}
31624+
31625+
function buildS3UploadEnv() {
31626+
const savedAwsEnv = getSavedAwsEnv();
31627+
if (!hasSavedAwsCredentialSource(savedAwsEnv)) {
31628+
return process.env;
31629+
}
31630+
31631+
const uploadEnv = { ...process.env };
31632+
for (const name of AWS_ENV_NAMES) {
31633+
delete uploadEnv[name];
31634+
delete uploadEnv[`STATE_${AWS_ENV_STATE_PREFIX}${name}`];
31635+
}
31636+
Object.assign(uploadEnv, savedAwsEnv);
31637+
core.info('Using captured AWS environment for S3 upload');
31638+
return uploadEnv;
31639+
}
31640+
3158931641
async function waitForExit() {
3159031642
const deadline = Date.now() + SHUTDOWN_TIMEOUT_MS;
3159131643
while (Date.now() < deadline) {
@@ -31818,7 +31870,7 @@ async function run() {
3181831870
EVENTS_FILE,
3181931871
s3Uri,
3182031872
'--content-type', 'application/x-ndjson',
31821-
]);
31873+
], { env: buildS3UploadEnv() });
3182231874
core.info('Upload complete');
3182331875
try {
3182431876
fs.unlinkSync(EVENTS_FILE);

‎src/main.js‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,22 @@ const EVENTS_FILE = '/tmp/ebpf-network-events.json';
1212
const ORAS_VERSION = '1.2.3';
1313
const ORAS_FILENAME = `oras_${ORAS_VERSION}_linux_amd64.tar.gz`;
1414
const ORAS_LINUX_AMD64_SHA256 = 'b4efc97a91f471f323f193ea4b4d63d8ff443ca3aab514151a30751330852827';
15+
const AWS_ENV_STATE_PREFIX = 'AWS_ENV_';
16+
const AWS_ENV_NAMES = [
17+
'AWS_ACCESS_KEY_ID',
18+
'AWS_SECRET_ACCESS_KEY',
19+
'AWS_SESSION_TOKEN',
20+
'AWS_REGION',
21+
'AWS_DEFAULT_REGION',
22+
'AWS_PROFILE',
23+
'AWS_SHARED_CREDENTIALS_FILE',
24+
'AWS_CONFIG_FILE',
25+
];
26+
const AWS_SECRET_ENV_NAMES = new Set([
27+
'AWS_ACCESS_KEY_ID',
28+
'AWS_SECRET_ACCESS_KEY',
29+
'AWS_SESSION_TOKEN',
30+
]);
1531
// Resolve the binary tag from the action ref so that
1632
// `uses: skroutz/ebpf-tracker@v1.2.3` always pulls the v1.2.3 binary.
1733
// Falls back to 'latest' when run outside of Actions (e.g. local testing).
@@ -32,6 +48,23 @@ function verifyOrasTarball(tarball) {
3248
core.info(`Verified ORAS ${ORAS_VERSION} checksum (${actual})`);
3349
}
3450

51+
function saveAwsEnvState() {
52+
let saved = 0;
53+
for (const name of AWS_ENV_NAMES) {
54+
const value = process.env[name];
55+
if (!value) continue;
56+
if (AWS_SECRET_ENV_NAMES.has(name)) {
57+
core.setSecret(value);
58+
}
59+
core.saveState(`${AWS_ENV_STATE_PREFIX}${name}`, value);
60+
saved += 1;
61+
}
62+
63+
if (saved > 0) {
64+
core.info('Captured AWS environment for post S3 upload');
65+
}
66+
}
67+
3568
/**
3669
* Poll until the tracker has written its PID file, or the timeout expires.
3770
* Returns the PID as a number, or null if the file never appeared.
@@ -62,6 +95,9 @@ async function run() {
6295

6396
core.saveState('OUTPUT_MODE', outputMode);
6497
core.saveState('S3_BUCKET', s3Bucket);
98+
if (outputMode === 's3' && s3Bucket) {
99+
saveAwsEnvState();
100+
}
65101

66102
// Install ORAS CLI if not already on PATH.
67103
let orasPath = 'oras';

‎src/post.js‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,22 @@ const dns = require('dns');
66
const EVENTS_FILE = '/tmp/ebpf-network-events.json';
77
const SHUTDOWN_TIMEOUT_MS = 15000;
88
const POLL_INTERVAL_MS = 100;
9+
const AWS_ENV_STATE_PREFIX = 'AWS_ENV_';
10+
const AWS_ENV_NAMES = [
11+
'AWS_ACCESS_KEY_ID',
12+
'AWS_SECRET_ACCESS_KEY',
13+
'AWS_SESSION_TOKEN',
14+
'AWS_REGION',
15+
'AWS_DEFAULT_REGION',
16+
'AWS_PROFILE',
17+
'AWS_SHARED_CREDENTIALS_FILE',
18+
'AWS_CONFIG_FILE',
19+
];
20+
const AWS_SECRET_ENV_NAMES = new Set([
21+
'AWS_ACCESS_KEY_ID',
22+
'AWS_SECRET_ACCESS_KEY',
23+
'AWS_SESSION_TOKEN',
24+
]);
925

1026
function isAlive() {
1127
// Check by process name: this is the only reliable signal because the saved
@@ -20,6 +36,42 @@ function isAlive() {
2036
}
2137
}
2238

39+
function getSavedAwsEnv() {
40+
const savedEnv = {};
41+
for (const name of AWS_ENV_NAMES) {
42+
const value = core.getState(`${AWS_ENV_STATE_PREFIX}${name}`);
43+
if (!value) continue;
44+
if (AWS_SECRET_ENV_NAMES.has(name)) {
45+
core.setSecret(value);
46+
}
47+
savedEnv[name] = value;
48+
}
49+
return savedEnv;
50+
}
51+
52+
function hasSavedAwsCredentialSource(savedAwsEnv) {
53+
return (
54+
(savedAwsEnv.AWS_ACCESS_KEY_ID && savedAwsEnv.AWS_SECRET_ACCESS_KEY) ||
55+
savedAwsEnv.AWS_PROFILE
56+
);
57+
}
58+
59+
function buildS3UploadEnv() {
60+
const savedAwsEnv = getSavedAwsEnv();
61+
if (!hasSavedAwsCredentialSource(savedAwsEnv)) {
62+
return process.env;
63+
}
64+
65+
const uploadEnv = { ...process.env };
66+
for (const name of AWS_ENV_NAMES) {
67+
delete uploadEnv[name];
68+
delete uploadEnv[`STATE_${AWS_ENV_STATE_PREFIX}${name}`];
69+
}
70+
Object.assign(uploadEnv, savedAwsEnv);
71+
core.info('Using captured AWS environment for S3 upload');
72+
return uploadEnv;
73+
}
74+
2375
async function waitForExit() {
2476
const deadline = Date.now() + SHUTDOWN_TIMEOUT_MS;
2577
while (Date.now() < deadline) {
@@ -252,7 +304,7 @@ async function run() {
252304
EVENTS_FILE,
253305
s3Uri,
254306
'--content-type', 'application/x-ndjson',
255-
]);
307+
], { env: buildS3UploadEnv() });
256308
core.info('Upload complete');
257309
try {
258310
fs.unlinkSync(EVENTS_FILE);

0 commit comments

Comments
 (0)